Jarl 0.1.0: manage BIND through a web UI, REST API and CLI
Jarl keeps a BIND 9.20 server's whole configuration (views, ACLs, TSIG keys, zones of every type, records, named.conf options) in SQLite and renders named.conf, keys.conf and zone files from it. Every change goes through one changeset pipeline: whole-configuration validation, named-checkconf -z and named-checkzone in a staging directory, atomic install, rndc reconfig/reload, serial verification with rndc zonestatus, and rollback if named does not load the change. Changes apply one at a time by default or are bundled and applied together. Applied changesets can be reverted. - jarld: the daemon with the REST API and an embedded web UI, plus import, adopt, check, resync, backup and local user recovery commands - jarl: the CLI, including ACME DNS-01 hooks for certbot and acme.sh - users with argon2id passwords and CSRF-protected sessions; hashed API tokens with granular grants and roles; an audit log - systemd unit, sysusers.d/tmpfiles.d files, Makefile - unit tests, integration tests against a real named, scripts/e2e.sh - docs/ guides, README and CHANGELOG Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
abrown38andClaude Opus 5.5 committed
commit
bd6b8778e4
122 files changed
+29217
No files matched your search
@@ -0,0 +1,243 @@
|
||||
// Package client is a small Go client for Jarl's REST API, used by the
|
||||
// jarl CLI.
|
||||
package client
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"crypto/tls"
|
||||
"crypto/x509"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"io"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"os"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"jarl/internal/api"
|
||||
"jarl/internal/version"
|
||||
)
|
||||
|
||||
// Client talks to a Jarl server.
|
||||
type Client struct {
|
||||
BaseURL string
|
||||
Token string
|
||||
HTTP *http.Client
|
||||
// Changeset, if set, stages changes into this changeset instead of
|
||||
// applying them.
|
||||
Changeset int64
|
||||
DryRun bool
|
||||
Force bool
|
||||
}
|
||||
|
||||
// Options configure New.
|
||||
type Options struct {
|
||||
Server string
|
||||
Token string
|
||||
Insecure bool // skip TLS certificate verification
|
||||
CACert string // PEM file with an extra trusted CA
|
||||
Timeout time.Duration
|
||||
}
|
||||
|
||||
// New creates a client.
|
||||
func New(o Options) (*Client, error) {
|
||||
if o.Server == "" {
|
||||
return nil, fmt.Errorf("no server configured: use --server, JARL_SERVER or 'jarl config set server https://...'")
|
||||
}
|
||||
u, err := url.Parse(o.Server)
|
||||
if err != nil || (u.Scheme != "http" && u.Scheme != "https") || u.Host == "" {
|
||||
return nil, fmt.Errorf("invalid server URL %q (use e.g. https://dns.example.com:8053)", o.Server)
|
||||
}
|
||||
tr := http.DefaultTransport.(*http.Transport).Clone()
|
||||
tc := &tls.Config{MinVersion: tls.VersionTLS12, InsecureSkipVerify: o.Insecure} //nolint:gosec // explicit user choice
|
||||
if o.CACert != "" {
|
||||
pem, err := os.ReadFile(o.CACert)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
pool, err := x509.SystemCertPool()
|
||||
if err != nil || pool == nil {
|
||||
pool = x509.NewCertPool()
|
||||
}
|
||||
if !pool.AppendCertsFromPEM(pem) {
|
||||
return nil, fmt.Errorf("no certificates in %s", o.CACert)
|
||||
}
|
||||
tc.RootCAs = pool
|
||||
}
|
||||
tr.TLSClientConfig = tc
|
||||
timeout := o.Timeout
|
||||
if timeout == 0 {
|
||||
timeout = 2 * time.Minute
|
||||
}
|
||||
return &Client{BaseURL: strings.TrimSuffix(o.Server, "/"), Token: o.Token, HTTP: &http.Client{Transport: tr, Timeout: timeout}}, nil
|
||||
}
|
||||
|
||||
// Error is an API error.
|
||||
type Error struct {
|
||||
Status int
|
||||
Info api.ErrorInfo
|
||||
}
|
||||
|
||||
func (e *Error) Error() string {
|
||||
if e.Info.Message != "" {
|
||||
return e.Info.Message
|
||||
}
|
||||
return fmt.Sprintf("HTTP %d", e.Status)
|
||||
}
|
||||
|
||||
// Problem is a validation problem (a subset of the server's fields).
|
||||
type Problem struct {
|
||||
Severity string `json:"severity"`
|
||||
Code string `json:"code"`
|
||||
Message string `json:"message"`
|
||||
Zone string `json:"zone"`
|
||||
View string `json:"view"`
|
||||
}
|
||||
|
||||
// CheckMessage is a named-checkconf message.
|
||||
type CheckMessage struct {
|
||||
Text string `json:"text"`
|
||||
Error bool `json:"error"`
|
||||
Object string `json:"object"`
|
||||
}
|
||||
|
||||
// Problems returns the validation problems attached to the error.
|
||||
func (e *Error) Problems() []Problem {
|
||||
var ps []Problem
|
||||
if len(e.Info.Problems) > 0 {
|
||||
json.Unmarshal(e.Info.Problems, &ps)
|
||||
}
|
||||
return ps
|
||||
}
|
||||
|
||||
// Check returns named-checkconf messages attached to the error.
|
||||
func (e *Error) Check() []CheckMessage {
|
||||
var ms []CheckMessage
|
||||
if len(e.Info.Check) > 0 {
|
||||
json.Unmarshal(e.Info.Check, &ms)
|
||||
}
|
||||
return ms
|
||||
}
|
||||
|
||||
// Do sends a request. body is marshaled as JSON; out (if not nil) receives
|
||||
// the JSON response.
|
||||
func (c *Client) Do(ctx context.Context, method, path string, query url.Values, body, out any) error {
|
||||
u := c.BaseURL + api.Prefix + path
|
||||
if len(query) > 0 {
|
||||
u += "?" + query.Encode()
|
||||
}
|
||||
var rd io.Reader
|
||||
if body != nil {
|
||||
b, err := json.Marshal(body)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
rd = bytes.NewReader(b)
|
||||
}
|
||||
req, err := http.NewRequestWithContext(ctx, method, u, rd)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if body != nil {
|
||||
req.Header.Set("Content-Type", "application/json")
|
||||
}
|
||||
req.Header.Set("Accept", "application/json")
|
||||
req.Header.Set("User-Agent", "jarl-cli/"+version.Version)
|
||||
if c.Token != "" {
|
||||
req.Header.Set("Authorization", "Bearer "+c.Token)
|
||||
}
|
||||
resp, err := c.HTTP.Do(req)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
data, err := io.ReadAll(resp.Body)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if resp.StatusCode >= 400 {
|
||||
var eb api.ErrorBody
|
||||
if json.Unmarshal(data, &eb) != nil || eb.Error.Message == "" {
|
||||
eb.Error.Message = fmt.Sprintf("HTTP %d: %s", resp.StatusCode, strings.TrimSpace(string(data)))
|
||||
}
|
||||
return &Error{Status: resp.StatusCode, Info: eb.Error}
|
||||
}
|
||||
if out == nil || len(data) == 0 {
|
||||
return nil
|
||||
}
|
||||
if s, ok := out.(*string); ok {
|
||||
*s = string(data)
|
||||
return nil
|
||||
}
|
||||
return json.Unmarshal(data, out)
|
||||
}
|
||||
|
||||
// Get is Do with GET.
|
||||
func (c *Client) Get(ctx context.Context, path string, query url.Values, out any) error {
|
||||
return c.Do(ctx, http.MethodGet, path, query, nil, out)
|
||||
}
|
||||
|
||||
// Mutate sends a configuration change, honoring Changeset, DryRun and
|
||||
// Force.
|
||||
func (c *Client) Mutate(ctx context.Context, method, path string, query url.Values, body any) (*api.MutationResponse, error) {
|
||||
q := url.Values{}
|
||||
for k, v := range query {
|
||||
q[k] = v
|
||||
}
|
||||
if c.Changeset > 0 {
|
||||
q.Set("changeset", fmt.Sprint(c.Changeset))
|
||||
}
|
||||
if c.DryRun {
|
||||
q.Set("dry_run", "1")
|
||||
}
|
||||
if c.Force {
|
||||
q.Set("force", "1")
|
||||
}
|
||||
var out api.MutationResponse
|
||||
err := c.Do(ctx, method, path, q, body, &out)
|
||||
return &out, err
|
||||
}
|
||||
|
||||
// Result is the part of an engine result the CLI shows.
|
||||
type Result struct {
|
||||
ChangesetID int64 `json:"changeset_id"`
|
||||
Applied bool `json:"applied"`
|
||||
Valid bool `json:"valid"`
|
||||
Problems []Problem `json:"problems"`
|
||||
Existing []Problem `json:"existing_problems"`
|
||||
Check []CheckMessage `json:"check"`
|
||||
Diff string `json:"diff"`
|
||||
Files []string `json:"files_changed"`
|
||||
Serials []struct {
|
||||
Zone string `json:"zone"`
|
||||
View string `json:"view"`
|
||||
Old uint32 `json:"old"`
|
||||
New uint32 `json:"new"`
|
||||
} `json:"serials"`
|
||||
Reloaded []string `json:"reloaded"`
|
||||
Warnings []string `json:"warnings"`
|
||||
Ops []struct {
|
||||
Seq int `json:"seq"`
|
||||
Op string `json:"op"`
|
||||
ID int64 `json:"id"`
|
||||
Summary string `json:"summary"`
|
||||
} `json:"ops"`
|
||||
Error *struct {
|
||||
Code string `json:"code"`
|
||||
Message string `json:"message"`
|
||||
} `json:"error"`
|
||||
}
|
||||
|
||||
// ParseResult decodes the result embedded in a mutation response or error.
|
||||
func ParseResult(raw json.RawMessage) *Result {
|
||||
if len(raw) == 0 {
|
||||
return nil
|
||||
}
|
||||
var r Result
|
||||
if json.Unmarshal(raw, &r) != nil {
|
||||
return nil
|
||||
}
|
||||
return &r
|
||||
}
|
||||
Reference in new issue
Block a user